---
title: Local DWS APIs
slug: develop/local-dws-apis
docTags: 
createdAt: 2025-03-11T07:03:32.131Z
---

:::hint{type="warning"}
Local access (i.e., access over the local network) of the Diagnostic Web Server (DWS) is *disabled* by default as of BrightSignOS 9.0.218 (on the 9.0 branch) and BrightSignOS 9.1.75 (on the 9.1 branch). In BrightSignOS versions prior to these, local access to the DWS was enabled by default. To enable local access to the DWS, see [DWS: Local Access](docId\:IAFCHERlJfjDJTWTtKpk5).

Note that some specially configured players have the external microSD card port and USB storage disabled at the factory (SKU: SVC-internal-storage-only). For these players, local access to the DWS remains enabled by default.

Remote access (i.e., access over the internet) of the DWS remains available for all internet-connected players registered with BrightSign Cloud.
:::

There are two ways to access these APIs:

1. You can choose to use **digest authentication**. Digest authentication uses a username and a password. The username is always “admin”. The password can be set in three ways:
   - Use the default, which is the player serial number
   - Set it through the setup package
   - Set it using a custom script
2. You can choose to use **no authentication**. However, this is not recommended.

Once the password is set, you need to authenticate to access the Local DWS APIs. To do this:

- You should be using BrightSignOS 8.4.6 or newer.
- Call the desired API using digest authentication with the Local DWS username and password. Note that digest authentication is fairly insecure when used over an insecure transport (HTTP).

The URL prefix is always **https\://player\_ip/api**

# API Definitions

The listed APIs are prefixed with the version /v1. We can not guarantee that these documents will be current in every case.

- [LDWS Advanced Endpoints](docId\:RRbb0Z9dcT8MTxS9jQfo8) 
- [LDWS Control Endpoints](docId\:YLXb9c8Us70n09hoOkdp_) 
- [LDWS Diagnostics Endpoints](docId\:SAYOK1v5MYNJRFjDyJO5K) 
- [LDWS Display Control Endpoints](docId\:EeuFgOaVJljvCcGpGDXdn) 
- [LDWS General Endpoints](docId:7xFfmAhpax15y5oeYva1z) 
- [LDWS Info Endpoints](docId\:LRnVVAaa2rBz3-22KpTNu) 
- [LDWS Logs Endpoints](docId\:GVrlTps3CLNqwBF6nMEpM) 
- [LDWS Registry Endpoints](docId\:vGoS8rY1L2GRoThAU1OGK) 
- [LDWS Remote Snapshot Endpoint](docId:5clrLJAf12o4XJrg6TTdB) 
- [LDWS sendCecX Endpoint](docId\:V-ECyNuTwH-8p7ExQP06R) 
- [LDWS Storage Endpoints](docId:-NxNHjKhZyIJmLYmZrifA) 
- [LDWS Video Endpoints](docId\:ySqOggYSBTPMi8d_TyWz9) 

# Using HTTPS with the Local DWS

In BOS releases after BOS 8.2.35.4, users had the option use either a trusted certificate or a self-signed certificate to access HTTPS over the DWS. As of BOS 9.0.218 and 9.1.52, the Local DWS uses HTTPS by default with a self-signed certificate. Previously (in BOS 8.2.35.4 and newer) HTTPS was optional, but a self-signed certificate had to be provided. See [Add Digital Certificates](docId\:j17PU2fWzG7niK1NIYT-Y) for information about how to apply a certificate to a player.

If your existing scripts use **HTTP** to access LDWS, you should update them to use **HTTPS**. If updating the scripts is not immediately possible, you may temporarily set the enable\_http\_redirect registry key in the networking section to false (link to the registry doc). This disables HTTP redirection, allowing your current scripts to continue functioning.

Please note that **HTTPS is enforced regardless of the registry key setting**. The registry key only controls HTTP redirection behavior and does not disable HTTPS enforcement. 

## Generating a Self-Signed Certificate and Key

To do this, choose one of the following two methods:

1. Run this code: 

:::CodeblockTabs{indent="2"}
```text
openssl req -nodes -new -x509 -keyout dws.key -out dws.crt
```
:::

2. OR run the following code and use the 'dws.key' and 'dws.crt' files. The other files can be deleted later.

```text
openssl req -newkey rsa:4096 -keyform PEM -keyout ca.key -x509 -days 3650 -outform PEM -out ca.cer
openssl genrsa -out dws.key 4096
openssl req -new -key dws.key -out client.req
openssl x509 -req -in client.req -CA ca.cer -CAkey ca.key -set_serial 101 -extensions client -days 365 -outform PEM -out dws.crt
```

## Making the Certificate and Key Files Accessible

The operating system will look for files with known names at the root of the default storage. To make the certificate and key files you generated findable, either:

1. <font color="hsl(var(--ab-gray-900))">Name the files **dws.crt** and **dws.key**, as in the examples. </font>
2. <font color="hsl(var(--ab-gray-900))">Put the names of the files in the networking registry using the keys **ldws_cert_file_name**, **ldws_key_file_name**</font>. See [BrightSign Registry Keys](docId:8LUJ1vpF-ftLCBISBqBvZ) for more information.

:::hint{type="info"}
<font color="hsl(var(--ab-gray-900))">If you want to supply the CA certificate, you can use the default name **dws.ca** or if you want to use another name use the registry key **ldws_ca_file_name** to specify the filename.</font>
:::

<font color="hsl(var(--ab-gray-900))">Then put the files at the root of the default storage. If you have defined the **ldws_certs_path** registry key, this will be the certs location (rather than the default storage).</font>